Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
29-12-2023 19:13
Behavioral task
behavioral1
Sample
016153c37340d7dd4d45563208a25928.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
016153c37340d7dd4d45563208a25928.exe
Resource
win10v2004-20231215-en
General
-
Target
016153c37340d7dd4d45563208a25928.exe
-
Size
420KB
-
MD5
016153c37340d7dd4d45563208a25928
-
SHA1
591f8da7ede0f741c04ec18348999e7a39e96183
-
SHA256
f41fc6480ca831a072c88d512b3ca96264c7d8652d30224b2f88465139dc8319
-
SHA512
bdd7af6d07f38eae6e7500ac6d6d5175889e82a4d515025d6899049b1d56f46196d8a418e2b82a94865c7236a44e78f29af551548810f07fba1b6afce30e830f
-
SSDEEP
6144:49g5p/aJJL7XJAnY7jioSgBK0Ru115xTcYeEknZJJAVAel:4gUJHX+nOjhBq1j2AWK
Malware Config
Extracted
remcos
2.5.0 Pro
Buddy
eastsidepapi.myq-see.com:6996
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Buddy.exe
-
copy_folder
remcos
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Buddy-PVO134
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Buddy
-
take_screenshot_option
false
-
take_screenshot_time
5
-
take_screenshot_title
wikipedia;solitaire;
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
ftermgr.exeftermgr.exepid process 2172 ftermgr.exe 2912 ftermgr.exe -
Loads dropped DLL 6 IoCs
Processes:
powershell.exeWerFault.exepid process 2768 powershell.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe 2400 WerFault.exe -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1680-2-0x0000000000540000-0x0000000000556000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\progmfil = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Local\\ftermgr.exe" reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ftermgr.exedescription pid process target process PID 2172 set thread context of 2912 2172 ftermgr.exe ftermgr.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2400 2172 WerFault.exe ftermgr.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
016153c37340d7dd4d45563208a25928.exepowershell.exeftermgr.exepid process 1680 016153c37340d7dd4d45563208a25928.exe 1680 016153c37340d7dd4d45563208a25928.exe 1680 016153c37340d7dd4d45563208a25928.exe 2768 powershell.exe 2768 powershell.exe 2172 ftermgr.exe 2172 ftermgr.exe 2172 ftermgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
016153c37340d7dd4d45563208a25928.exepowershell.exeftermgr.exedescription pid process Token: SeDebugPrivilege 1680 016153c37340d7dd4d45563208a25928.exe Token: SeDebugPrivilege 2768 powershell.exe Token: SeDebugPrivilege 2172 ftermgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ftermgr.exepid process 2912 ftermgr.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
016153c37340d7dd4d45563208a25928.execmd.exepowershell.exeftermgr.exedescription pid process target process PID 1680 wrote to memory of 2560 1680 016153c37340d7dd4d45563208a25928.exe cmd.exe PID 1680 wrote to memory of 2560 1680 016153c37340d7dd4d45563208a25928.exe cmd.exe PID 1680 wrote to memory of 2560 1680 016153c37340d7dd4d45563208a25928.exe cmd.exe PID 1680 wrote to memory of 2560 1680 016153c37340d7dd4d45563208a25928.exe cmd.exe PID 2560 wrote to memory of 2612 2560 cmd.exe reg.exe PID 2560 wrote to memory of 2612 2560 cmd.exe reg.exe PID 2560 wrote to memory of 2612 2560 cmd.exe reg.exe PID 2560 wrote to memory of 2612 2560 cmd.exe reg.exe PID 1680 wrote to memory of 2768 1680 016153c37340d7dd4d45563208a25928.exe powershell.exe PID 1680 wrote to memory of 2768 1680 016153c37340d7dd4d45563208a25928.exe powershell.exe PID 1680 wrote to memory of 2768 1680 016153c37340d7dd4d45563208a25928.exe powershell.exe PID 1680 wrote to memory of 2768 1680 016153c37340d7dd4d45563208a25928.exe powershell.exe PID 2768 wrote to memory of 2172 2768 powershell.exe ftermgr.exe PID 2768 wrote to memory of 2172 2768 powershell.exe ftermgr.exe PID 2768 wrote to memory of 2172 2768 powershell.exe ftermgr.exe PID 2768 wrote to memory of 2172 2768 powershell.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2912 2172 ftermgr.exe ftermgr.exe PID 2172 wrote to memory of 2400 2172 ftermgr.exe WerFault.exe PID 2172 wrote to memory of 2400 2172 ftermgr.exe WerFault.exe PID 2172 wrote to memory of 2400 2172 ftermgr.exe WerFault.exe PID 2172 wrote to memory of 2400 2172 ftermgr.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\016153c37340d7dd4d45563208a25928.exe"C:\Users\Admin\AppData\Local\Temp\016153c37340d7dd4d45563208a25928.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v progmfil /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\ftermgr.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v progmfil /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Local\ftermgr.exe"3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Process C:\Users\Admin\AppData\Local\ftermgr.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ftermgr.exe"C:\Users\Admin\AppData\Local\ftermgr.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\ftermgr.exe"C:\Users\Admin\AppData\Local\ftermgr.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2172 -s 9324⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ftermgr.exeFilesize
382KB
MD53bf12ad02a9a8ad1c60e23ebc9036452
SHA18291666b272eaf5516e9cf742d7f5a93606861f4
SHA256f0a01e30910e210ff068607568d17b2f6d52b92b257cd05f62b9e2ee2d9f6c1d
SHA5122946ed84e8e02f67d94fb18e7ff35fbde1eaebd5a042056535722ba691fdaf7e0ab7c5549aa71509c53006c3caeb38b24981609ce10e9d1d8cf55437d21bca56
-
\Users\Admin\AppData\Local\ftermgr.exeFilesize
420KB
MD5016153c37340d7dd4d45563208a25928
SHA1591f8da7ede0f741c04ec18348999e7a39e96183
SHA256f41fc6480ca831a072c88d512b3ca96264c7d8652d30224b2f88465139dc8319
SHA512bdd7af6d07f38eae6e7500ac6d6d5175889e82a4d515025d6899049b1d56f46196d8a418e2b82a94865c7236a44e78f29af551548810f07fba1b6afce30e830f
-
memory/1680-9-0x0000000004600000-0x0000000004640000-memory.dmpFilesize
256KB
-
memory/1680-10-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1680-4-0x0000000004600000-0x0000000004640000-memory.dmpFilesize
256KB
-
memory/1680-0-0x0000000000CA0000-0x0000000000D10000-memory.dmpFilesize
448KB
-
memory/1680-6-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1680-7-0x0000000000AC0000-0x0000000000AC8000-memory.dmpFilesize
32KB
-
memory/1680-1-0x0000000073F60000-0x000000007464E000-memory.dmpFilesize
6.9MB
-
memory/1680-5-0x0000000000920000-0x0000000000928000-memory.dmpFilesize
32KB
-
memory/1680-2-0x0000000000540000-0x0000000000556000-memory.dmpFilesize
88KB
-
memory/1680-3-0x00000000005C0000-0x00000000005C8000-memory.dmpFilesize
32KB
-
memory/2172-23-0x000000006F820000-0x000000006FF0E000-memory.dmpFilesize
6.9MB
-
memory/2172-19-0x0000000000F20000-0x0000000000F90000-memory.dmpFilesize
448KB
-
memory/2172-21-0x000000006F820000-0x000000006FF0E000-memory.dmpFilesize
6.9MB
-
memory/2172-24-0x0000000000A70000-0x0000000000A7A000-memory.dmpFilesize
40KB
-
memory/2172-27-0x0000000000620000-0x0000000000660000-memory.dmpFilesize
256KB
-
memory/2172-22-0x0000000000620000-0x0000000000660000-memory.dmpFilesize
256KB
-
memory/2768-14-0x0000000073830000-0x0000000073DDB000-memory.dmpFilesize
5.7MB
-
memory/2768-13-0x0000000073830000-0x0000000073DDB000-memory.dmpFilesize
5.7MB
-
memory/2768-15-0x0000000002790000-0x00000000027D0000-memory.dmpFilesize
256KB
-
memory/2768-20-0x0000000073830000-0x0000000073DDB000-memory.dmpFilesize
5.7MB
-
memory/2912-36-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-28-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-30-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-32-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-34-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-25-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-38-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2912-40-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-44-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-48-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-47-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-43-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2912-56-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB